Webgoat - Client side filtering

Webgoat – Client side filtering

In this walk through, we will be going through the Client side filtering vulnerability section from Webgoat Labs. We will be exploring and exploiting Client side filtering in Salary manager application and online product page and learn how application are affected because of it. So, let’s get started with the Hacking without any delay.

Client side filtering

1. Salary manager

  • In this challenge, we have to find the salary of the company’s CEO which is not in the front end to view.

Salary manager

  • I just search the name of the CEO in the Dev Tools inspector search and got a hit. The employee records were blocked to display in front end using CSS. Submit the salary value to complete the challenge.

Making changes via Inspect element

Challenge competed

2. No Payment

  • In this challenge, we have to try to purchase the phone for free.

No Payment

  • I checked out the coupon code field in the HTML souce code and found bunch of checkout codes. Tried all them however was unable to purchase the phone for free.

Page source code

  • Then, i observed the entered coupoun code in the dev tools network tab and found out that the application is issuing a GET Request to /WebGoat/clientSideFiltering/challenge-store/coupons/ endpoint to get the coupon code value.

Setting the paramters

GET request

  • So, i designed a GET Request on the target endpoint. Changed the content-type header to application/json and send the request. In the response, i received all the available coupon codes. The last one has a discount of 100%. Using that completed our challenge.

Burpsuite intercept

Burpsuite Response

Challenge completed

Also Read: Webgoat – Admin password reset



So, we finally completed the Webgoat Client side filtering Vulnerability section. Next, we can mitigate these types of attacks by processing data more on the server side and not give the user the access to interfere with the application’s logic by manipulating data on client side. On that note, i will take your leave and will meet you in next one with another Webgoat vulnerability writeup, till then “Keep Hacking”.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top